User manual KASPERSKY LAB KASPERSKY INSPECTOR 3.5 FOR WINDOWS

KASPERSKY LABS Kaspersky Inspector 3.5 for Windows USER GUIDE KASPERSKY INSPECTOR 3.5 FOR WINDOWS User Guide Kaspersky Labs Ltd. Tel. +7(095)797-87-00 · Fax +7(095)948-43-31 Visit our WEB site: http://www.kaspersky.com/ C ne t o t ns 1. Kaspersky Inspector for Windows ....................... 8 1.1. Features and function............................................. 8 1.2. Features of Kaspersky InspectorTM under MS Windows NT ................................................................ 10 1.3. New features of Kaspersky Inspector 3.5 ......... 10 1.4. Distribution kit ....................................................... 11 1.4.1. What is in your KAV distribution kit ........... 11 1.4.2. License agreement........................................ 11 1.4.3. Registration card ........................................... 12 1.5. Help desk for registered users ............................ 12 1.6. Information in the book ....................................... 13 Installing Kaspersky Inspector ........................... 14 2.1. Software and hardware requirements ............... 14 2.2. Running setup wizard........................................... 15 2.2.1. Installing......................................................... 15 2.2.2. Reinstalling..................................................... 25 2.2.3. Removing........................................................ 27 2.3. The .KEY File.......................................................... 30 The program's Operation Concept ..................... 31 3.1. Checks that Kaspersky Inspector performs ...... 32 3.2. Analysing changes on your disk.......................... 33 3.3. Searching for stealth viruses ............................... 35 3 2. 3. 3.4. Deleting viruses using KAVI Cure ModuleTM ......36 3.4.1. KAVI Cure Module for Windows ..................36 3.4.2. KAVI Cure Module for DOS32 ......................37 3.5. Checking the OS parameters during the boot (the KAVIBOOT.VXD driver).............................................38 4. Kaspersky Inspector Interface.............................39 4.1. Main window...........................................................39 4.2. Menu-bar.................................................................41 4.3. Tool-bar...................................................................42 4.4. Icon-bar...................................................................44 4.5. Work-area ...............................................................45 4.6. Status-bar ...............................................................46 4.7. Interface elements for programm settings ........46 4.7.1. Settings' tree ..................................................47 4.7.2. Controls ...........................................................47 4.7.3. Control indicators...........................................51 Starting Kaspersky Inspector ...............................54 5.1. How to start the program.....................................54 5.1.1. Starting the program using the MS Windows Start menu ......................................................................54 5.1.2. Starting Kaspersky Inspector from the command line .................................................................55 5.1.3. Starting Kaspersky Inspector using Control Centre 59 5.2. Starting the program the first time .....................59 5.3. Starting to check for changes on your disk .......60 5.3.1. Checking for changes on the disk ...............60 5.3.2. Creating new tables.......................................60 5.4. Starting to search for stealth viruses..................61 Customising Kaspersky Inspector.......................63 4 5. 6. 6.1. The Options work-area: Selecting general options ................................................................................ 63 6.1.1. Using the wizard to define general settings 64 6.1.2. Defining the location of working files and folders. Check modes ................................................... 69 6.1.3. File check parameters .................................. 71 6.1.4. These checks can be disabled..................... 78 6.1.5. Selecting options for Cure Module ............. 79 6.1.6. Selecting options for the anti-virus scanner 81 6.1.7. Selecting options for the performance report 82 6.2. The Objects work-area: Selecting options for every drive to be checked................................................ 84 6.2.1. Defining check parameters for hard, network and logical drives ........................................... 84 6.2.2. Defining how to access a drive ................... 85 6.2.3. Items to be checked on the drive............... 87 6.2.4. Defining how to calculate CRC values ....... 87 6.2.5. Checking for stealth viruses ........................ 88 6.2.6. Advanced settings......................................... 89 6.3. Saving and loading settings................................. 89 7. Viewing Check Results............................................ 91 7.1. The Statistics work-area: Viewing Kaspersky Inspector performance statistics .................................... 91 7.2. The Disks work-area: Viewing changes detected 92 7.3. The Disks work-area: Working with modifications detected.............................................................................. 95 7.4. The Disks work-area: Master Boot Record details 98 5 7.5. The Disks work-area: Boot Record details.........99 7.6. The Registry work-area: Viewing modifications in registry files ......................................................................101 7.7. Disks and Registry work-areas: Allowing/prohibiting to change KAVI tables ................104 8. Running KAVI Cure Module for DOS32 ...........106 8.1. KAVI Cure Module for DOS32 ............................106 8.2. Launching KAVI Cure Module for DOS32.........107 8.3. Creating Cure diskette ........................................108 Messages about Suspicious Changes...............110 9.1. Messages: when the check is completed.........110 9.1.1. Boot or Master Boot record changed........112 9.2. New bad clusters appeared................................113 9.3. Stealth virus detected .........................................113 9.4. Troubleshooting ...................................................115 9. 10. Warnings and Error Messages ........................116 10.1. Messages: launching or running Kaspersky Inspector ...........................................................................118 10.2. Messages: checking Master Boot and Boot records 119 10.3. Messages: checking debug registers ............119 10.4. Messages: launching Kaspersky Inspector ..120 10.5. Messages of the KAVIBOOT.VXD driver.......121 11. Kaspersky Labs Ltd.............................................125 11.1. About Kaspersky Labs .....................................125 11.2. Other Kaspersky Labs Products....................126 11.3. Kaspersky Labs Contact Information............131 6 Dear Customer, Thank you for choosing Kaspersky Anti-Virus to protect your computer from viruses. We have worked hard to make this product meet the highest possible standards and feel sure that you will find it efficient and effective. By choosing our software, you acquire the unbeatable protection against viruses. Our company always seeks to make the software products more friendly and easy-to-use while keeping their functionality at the same level. Kaspersky Anti-Virus provides its users with the highly reliable anti-virus protection, heuristic code-analyser, ability to check for viruses in all the commonly used mail formats and compressed files, easy-to-use antivirus managing tools. Furthermore the user is provided with round-theclock technical support, information service, personal attention to every client and immediate response to new viruses. We highly appreciate your confidence in our product and hope you'll find it fairly efficient and useful. Kaspersky Labs 7 1 What is Kaspersky Inspector for Windows? Distribution kit. Chapter 1. Kaspersky Inspector for Windows 1.1. Features and function Kaspersky InspectorTM (KAVI) is an integrity checker running under Microsoft Windows 95/98/ME® or Microsoft Windows NT/2000®. Kaspersky Inspector checks disks for modifications in files and directories. The program can be used as a supplementary anti-virus program to monitor changes on the disk. The program reduces the time you need to check your computer using the KAV scanner, since now, your Kaspersky Inspector will provide the scanner with information about the files that have been changed or created, and the scanner will check for viruses in those files only. 8 KASPERSKY ANTI-VIRUS While checking for changes on your disk the program collects the data and saves it to the table. This table contains images of your Master Boot and Boot records, the list of bad clusters, the schema of your directory tree and information about every controlled file. Kaspersky Inspector accesses your disks directly via the IOS (Input-Output Supervisor) driver without using the conventional methods (the 21h and 13h interrupts). This feature allows the program to detect and kill even the most dangerous stealth viruses that settle themselves in the computer memory and process those vital for your computer interruptions. Besides, Kaspersky Inspector remembers and, when started again, checks the size of available DOS memory (most boot viruses change the size of random access memory), and the quantity of hard drives installed. The main features of Kaspersky Inspector are the following: accesses the disks directly via the IOS (Input-Output Supervisor) driver, bypassing DOS resident viruses (boot viruses in particular, since they intercept the 13h interruption when the computer is booted). allows to recover boot sectors on the disks. allows to check network and compressed drives. allows to read FAT12, FAT16, VFAT32, NTFS file systems without using the corresponding OS functions. analyses files while searching for the identical change in their sizes. processes OLE2 documents (the Word, Excel and Access documents). allows to recover DOS and Windows 95/98/NT executable files (KAVI Cure Module provides this possibility). 9 KASPERSKY INSPECTOR allows to detect stealth viruses in the wild. 1.2. Features of Kaspersky InspectorTM under MS Windows NT Due to architectural features of Microsoft Windows NT®, while running in this environment Kaspersky Inspector does not check: · · debug registers; size of the available DOS memory. Other functions of Kaspersky Inspector are performed under Microsoft Windows in corpora. 1.3. New features of Kaspersky Inspector 3.5 In this version we introduce new user interface (see chapter ! .). This interface solution allows you to understand more clearly both the hierarchy of general settings (see subchapter 6.1) and the hierarchy of settings for various drive types (see subchapter 6.2). 10 KASPERSKY ANTI-VIRUS 1.4. 1.4.1. Distribution kit What is in your KAV distribution kit Your KAV distribution kit contains the following items: · · · · license agreement; sealed envelope with diskettes (or CD) containing the program installation files; Kaspersky Inspector 3.5 User Guide; registration card. Before you unseal the envelope with diskettes (or CD) make sure to review thoroughly the license agreement. 1.4.2. License agreement License Agreement is a legal agreement between you (either an individual or a single entity) and the manufacturer (Kaspersky Labs LTD) describing the terms on which you may employ this anti-virus product. Make sure to peruse this LA! If you do not agree to terms of this LA, Kaspersky Labs is not willing to license the software product to you and you should return the unused product to your KAV dealer for a full refund, but make sure the envelope with CD (or diskettes) is sealed. 11 KASPERSKY INSPECTOR IF YOU UNSEAL THE ENVELOPE IT MEANS THAT YOU AGREED TO ALL THE LA TERMS. 1.4.3. Registration card To register you must fill the detachable coupon of your registration card (your full name, phone and e-mail address) and mail it to the Kaspersky Labs legal dealer that sold this kit to you. If your mail/e-mail address or phone number changed please notify the entity to which you mailed the coupon. When registered you obtain the status of Kaspersky Labs legal customer and will be provided with the product support and antivirus database updates for the period of your subscription. Furthermore Kaspersky Labs provides Kaspersky Anti-Virus registered users with information about the new products released by the company. 1.5. Help desk for registered users Kaspersky Labs offers a large service package enabling its legal customers to employ Kaspersky Inspector efficiently. If you register and purchase a subscription you will be provided with the following services for the period of your subscription: · · anti-virus database WEEKLY updates; new versions of the Kaspersky Labs anti-virus software provided on the FREE basis; 12 KASPERSKY ANTI-VIRUS · · PHONE, E-MAIL or IN-OFFICE advising on matters related to the operation of our anti-virus software; information about the Kaspersky Labs new products and about new computer viruses. For more information about our services refer to your README.TXT. Kaspersky Labs does not provide information related to operation and use of your operation system, and various technologies. 1.6. Information in the book This book contains information on how to install, customise and manage the software product, explains its basic concepts and the way they can be applied, recommends how to manage and change settings. 13 2 2. Installing Kaspersky Inspector Installing the program. The KEY file. Chapter 2.1. Software and hardware requirements In order to install Kaspersky Inspector you need a system that meets the following requirements: · IBM PC (or 100% compatible computer) with the MS Windows® 95/98/NT operation system pre-installed on it; minimum 16Mb of RAM (32 Mb is advisable) for Windows®95/98, and minimum 32 Mb of RAM (64 Mb is advisable) for Windows NT®; minimum 5 Mb of free space on the hard disk. 14 · · KASPERSKY ANTI-VIRUS 2.2. 2.2.1. Running setup wizard Installing To install the Kaspersky Inspector program on your file server, follow the steps: 1. Insert the supplied CD into the CD-ROM drive of your computer. 2. Start the Setup wizard program - setup.exe. 3. The Setup wizard will start (figure 1 and 2). Follow instructions on your screen. Figure 1. The InstallShield Wizard progress box 15 INSTALLING KASPERSKY INSPECTOR Figure 2. The Welcome wizard window 4. Read the window message and click the Next button to continue the installation. The License Agreement wizard window will appear on your screen (figure 3). 16 KASPERSKY ANTI-VIRUS Figure 3. The License Agreement wizard window 5. Review all the agreement terms. If they are acceptable click the Yes button to continue the installation. Click No to abort the installation if the terms are not acceptable. If you accepted the terms, the Customer Information wizard window will appear on your screen (figure 4). 17 INSTALLING KASPERSKY INSPECTOR Figure 4. The Customer Information wizard window 6. Enter your name and your company name into the User Name and Company Name text fields. Then click the Next button. The Choose Destination Location wizard window will appear on your screen (figure 5). 18 KASPERSKY ANTI-VIRUS Figure 5. The Choose Destination Location wizard window 7. In this window you must select the destination location for your Kaspersky Inspector software to be installed into: · Click the Browse button and use the Choose Folder wizard window (figure 6) to choose the folder. Click . In the Choose Destination Location wizard window click the Next button to continue the installation. · · 19 INSTALLING KASPERSKY INSPECTOR Figure 6. The Choose Folders wizard window 8. In the Select Program Folder wizard window (figure 7) you must select the Kaspersky Inspector program group in the Windows Start menu. When done, click the Next button to continue the installation. 20